I t is often said that Washington, D.C. is 69 square miles sur - PDF document

Cyber Security Regulation is Coming Here! Presentation delivered to the 12 th Annual RSA Security Conference – April 15, 2003 by Bruce J. Heiman I t is often said that Washington, D.C. is 69 square miles sur rounded by reality. Unfortunately, for those in the cyber se- curity business, reality is partially defined by what goes on in Washington, D.C. Certainly the private sector should be taking the lead in cyber security protection. After all, it’s the private sector that de- signed, developed and deployed the infrastructure, owns and operates practically all of it, and by far has the greater exper- tise in knowing how to best protect it. So it is not surprising that much of the government’s rhetoric continues to recognize the need for private sector leadership and a “partnership” with the government. But a closer examination of what the government has actually done reveals significant movement toward broader cyber security regulation and a patchwork of current cyber security requirements. As a result, you need to pay particular attention if you: are a health care organization or a financial institution; collect information from kids; do business in California; do business with the federal government; or have a privacy policy. Cyber security problems are getting Current Political Environment It’s all about security all the time. worse. CERT reported 82,000 inci- A closer examination of what the Washington, D.C., as well as New York dents last year, a 56 percent in- City, disproportionately feels the im- crease. Vulnerabilities increased 70 government has actually done reveals pact of security alerts. I work a block percent, to 4000. A February 2003 significant movement toward broader from the White House and heightened Symantec Internet Threat Security alerts mean we can’t park in the build- Report reviewed the experience of cyber security regulation and a patchwork ing and that we have to practice “shel- 400 companies in 30 countries. The of current cyber security requirements. tering in place” drills to protect report showed that the average against potential chemical or biologi- company experienced 30 attacks cal attacks. during the last six months of 2002, an increase of 20 percent. Disturb- Neither political party wants to appear soft on security. ingly, many of the attacks are now targeted at power and energy Recent polls show that Americans are 30 percent more inclined facilities, not just financial institutions or large businesses. Fi- to believe the Republicans are doing a good job to protect nally, the problem of proliferating spam also increases the gen- Americans than Democrats. This has led Democrats towards eral public’s sense of cyber vulnerability. an even tougher security approach. As Sandy Berger, National Security Adviser under President Clinton, told the RSA Confer- ence: “National security has now become personal security. We no longer feel invulnerable. … Our invincibility came crash- ing down on September 11.” 1735 NEW YORK AVENUE, NW SUITE 500 � WASHINGTON, DC 20006 � 202.628.1700 � FAX 202.331.1024 � www.pgerm.com

Cyber Security Regulation is Coming Here! (continued) thority and direction to the Department of Homeland Security. It The Government’s Response The concept of a “security gap” is taking hold, and is defined by the now has the lead on coordinating partnerships on Internet proto- difference between the amount of cyber security provided by the pri- cols, router technology and codes of conduct. It also discusses vate sector and the amount deemed “necessary” by the government. large procurements and product certification as methods of driv- The Bush Administration’s strategy of preemption is finding its way ing the market. Finally, it is important to remember that, so far , to the cyber security sphere. The President’s National Strategy to there has not been a widely reported true terrorist cyber attack. Secure Cyberspace states that: “We must act to reduce our vulner- Such an attack could lead to an explosive Congressional reaction. abilities to these [cyber] threats before they can be exploited.” The strategy says that government action is warranted where alleged The seeds for potential rollback in encryption policy also have been “market failures result in under-investment in cyber security.” sown. Senator Richard Shelby (R-AL), incoming Chairman of the Senate Banking Committee, which has jurisdiction over export con- But of course, this begs the question – who decides when there is trol laws, already has proposed legislation that would give a pre- enough security? The President’s National Strategy gives more au- eminent role to the security agencies and remove provisions pro- viding for automatic decontrol if there is foreign availability of a comparable encryption security product, or a determination is made that it is a mass-market product. Many, if not most, en- 2002 Developments in Cyber Security cryption products on the market today meet these tests. The so- called “PATRIOT II Act” also is reported to include a provision that The fastest worm ever documented – SQL Slammer would make the use of encryption to commit or hide a crime a or Sapphire, which doubled every 8.5 seconds – punishable offense. While on the one hand not objectionable – affected up to 300,000 servers, cut the speed of major concealing a crime already is punishable – there are serious con- U.S. Web sites in half, disabled an entire Washing- cerns that it could lead to a presumption that the use of encryp- ton State emergency response system and knocked tion is for criminal purposes. Even legislation in several states much of Korea off-line. intended to prevent theft of service from cable operators and ISPs would prevent the use and sale of most encryption devices, an- other example of the law of unintended consequences. The most significant governmental reorganization in a generation was created, the new Department of The federal government also has moved to improve its own cyber Homeland Security (DHS). security. This action is widely applauded and long overdue, but it also could lead to the imposition of similar measures on the pri- Presidential National Strategy to Secure Cyberspace vate sector. The government could adopt the approach of “what’s was developed, and put much less emphasis on good for the goose is good for the gander.” a public/private partnership; instead, it gave DHS the lead role in galvanizing certain recommendations The legislation creating the Department of Homeland Security in- and becoming program-driven in search of national cluded the Federal Information Security Management Act of 2002 solutions. (FISMA). This Act requires the development and implementation of mandatory “policies, principles, standards, and guidelines on information security” for all federal agencies by 2005. The Na- The largest cyber security R&D bill, authorizing $900 tional Institute of Standards and Technology (NIST) is charged million in spending over five years, was passed. with categorizing all federal information systems into “baskets” according to risk level and then developing flexible, performance- The Federal government increased appropriations for based standards for each basket. Importantly, NIST may not cyber security to $4.7 billion for the Fiscal Year ‘04. specify particular software or hardware security solutions. This prohibition was reinforced by NIST’s FY ‘03 appropriations bill, 1735 NEW YORK AVENUE, NW SUITE 500 � WASHINGTON, DC 20006 � 202.628.1700 � FAX 202.331.1024 � www.pgerm.com